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1. INTRODUCTION 

Quantum information theory has developed dramatically over the past de- 
cade, driven by the prospects of quantum-enhanced communication and com- 
putation systems. Among the most striking successes, one finds for example 
the discovery of quantum factoring, quantum key distribution, or quantum tele- 
portation. Most of these concepts were initially developed for discrete quantum 
variables, in particular quantum bits, which have now become the symbol of 
quantum information. Recently, however, a lot of attention has been devoted to 
investigating the use of continuous-variable systems in quantum informational 
or computational processes. Continuous-spectrum quantum variables, for ex- 
ample the quadrature components of a light mode, may be easier to manipulate 
than quantum bits. It is actually sufficient to process squeezed states of light 
into linear optics circuits in order to perform various quantum information pro- 
cesses over continuous variables [1]. As reported in the present book, variables 
with a continuous spectrum have been shown to be useful to carry out quantum 
teleportation, quantum entanglement purification, quantum error correction, or 
even quantum computation. 

In this Chapter, the issue of cloning a continuous-variable quantum system 
will be analyzed, and a Gaussian cloning transformation will be introduced. 
Cloning machines, that is, transformations that achieve the best approximate 
copying of a quantum state compatible with the no-cloning theorem, have been a 
fundamental research topic over the last five years (see e.g. [2] for an overview). 
This question is of particular significance given the close connection between 
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quantum cloning and quantum cryptography: using an optimal doner generally 
makes it possible to obtain a tight bound on the best individual eavesdropping 
strategy in a quantum cryptosystem. This provides a strong incentive to investi- 
gating continuous-variable cloning in view of the recent proposals for quantum 
key distribution relying on continuous (Gaussian) key carriers [3, 4]. 

Here, we will focus on a Gaussian cloning transformation, which copies 
equally well any two canonically conjugate continuous variables such as the 
two quadrature components of a light mode [5]. More precisely, it achieves the 
optimal cloning of a continuous variable that satisfies the requirement of covari- 
ance with respect to displacements and rotations in phase space. Consequently, 
this doner duplicates all coherent states with a same fidelity (F = 2/3). The 
optical implementation of this doner and its extension to iV-to-M doners will 
also be discussed. Finally, the use of this doner for the security assessment of 
continuous- variable quantum key distribution schemes will be sketched. 

2. LIMITS ON OPTIMAL CLONING 

Let us start by stating the problem of continuous-variable cloning in physical 
terms. Consider, as an example of canonically conjugate continuous variables, 
the quadrature components of a light mode, denoted as x and p. This notation 
reflects the fact that x and p behave just like the position and momentum of a 
particle in a one-dimensional space, namely their commutator is [x,p] = i (we 
put ft = 1 in this paper). If the wave function is a Dirac delta function — the 
particle is fully localized in position space, then x can be measured exactly, and 
several perfect copies of the system can be prepared. However, such a cloning 
process fails to exactly copy non-localized states, e.g., momentum states. Con- 
versely, if the wave function is a plane wave with momentum p — the particle is 
localized in momentum space, then p can be measured exactly and one can again 
prepare several perfect copies of this plane wave. However, such a "plane-wave 
doner" is then unable to copy position states exactly. In short, it is impossible 
to copy perfectly the eigenstates of two conjugate variables such as x and p: 
this is essentially the content of the so-called no-cloning theorem [6, 7]. 

In the next Section, we will show that a cloning transformation can nev- 
ertheless be found that provides two copies of a continuous system, but at the 
price of a non-unity cloning fidelity. In other words, the cloning machine yields 
two imperfect copies of the system. Before describing this cloning machine in 
details, let us find a lower bound on the cloning-induced noise by exploiting a 
connection with measurement theory. More specifically, we make use of the 
fact that measuring x on one clone and p on the other clone cannot beat the 
optimal joint measurement of x and p on the original system [8]. It is known 
that such a joint measurement of a pair of conjugate observables on a single 
quantum system obeys an inequality akin to the Heisenberg uncertainty relation 
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but with an extra contribution to the minimum variance [9]. Denoting by x and 
p the two quadratures of the input mode, and by X and P the corresponding 
jointly measured output quadratures, we have 

X = x + n x (1-la) 
P=p + n p (1.1b) 

where n x and n p stand for the excess noise that we have on the measured 
quadratures. Since we consider a joint measurement, the variables X and P 
must commute: they can be viewed respectively as the x and p quadratures of 
two distinct modes. Thus, we have 

[X,P] = [x,p] + [x,n p ] + [n x ,p] + [n x ,n p ] = (1.2) 

Assuming that the excess noises n x and n p are independent of the input quadra- 
tures, i.e., [x,n p ] = [n x ,p] = 0, we get [n x ,n p ] = —i, implying that n x and 
n p must obey an uncertainty relation. Specifically, any attempt to measure x 
and p simultaneously on a quantum system is constrained by the inequality 

An x An p > 1/2 (1.3) 

where An^ and An 2 denote the variances of the excess noises originating from 
the joint measurement device. If the variances of the x and p quadratures of 
the input state are denoted by 5x 2 and bp 2 , respectively, we thus have for the 
variances of the measured values AX 2 = 5x 2 + An 2 and AP 2 = bp 2 + An 2 . 
As a consequence, the Heisenberg uncertainty relation Sx 5p > 1/2 together 
with inequality (1.3) implies the relation [9] 

AX AP > 1 (1.4) 

where we have used the inequality a 2 + b 2 > 2a/ a 2 b 2 . Thus, the best possible 
joint measurement of x and p with a same precision on both quadratures of a 
coherent state (5x 2 = 5p 2 = 1/2) gives 

AX 2 = AP 2 = 1 (1.5) 

Compared with the vacuum noise, we note that the joint measurement of x and 
p effects an additional noise of minimum variance 1/2, so that the measured 
values suffer twice the vacuum noise. 

Inequality (1.3) immediately translates into a lower bound on the cloning- 
induced noise variance [8]. If we assume that the device that is used in order 
to perform the joint measurement of x and p is actually a cloning machine 
followed by two measuring apparatuses (x being measured on one clone and 
p on the other clone), we conclude that the variance of the noise added by this 
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cloning machine cannot be lower than 1/2 in order to comply with Eq. (1.3), 
that is 

An 2 x = An 2 p >l/2 (1.6) 

(We require here the same noise level on x and p.) This can also be shown 
explicitly by writing the canonical transformation of the doner [10]. Denoting 
by -^a(b) an( l Pa(b) the two quadratures of the output mode a (resp. b), we have 

X a = x + n x>a (1.7a) 

P a =P + n PA (1.7b) 

X h = x + (1.7c) 

p b =p + n pb (i.7d) 

where x and p are the two quadratures of the input mode and n x j va j b stand for 
the excess noises. Since the clones are carried by different modes (a and b), we 
have [X a , P b ] = [X b , P a ] = 0. Assuming, as before, that the excess noises are 
independent of the input mode, we get [n X)0 ,n Pj b] = [n Xj 6,n Pj0 ] = —i. This 
gives rise to two no-cloning uncertainty relations 

An x , a An P)b > 1/2 (1.8a) 
An x , b An w > 1/2 (1.8b) 

which constrain the excess noise variances An x / p , b of the two clones [5, 10]. 
Consequently, if the cloning process induces a small position (momentum) 
error on the first copy, then the second copy is necessarily affected by a large 
momentum (position) error. The Gaussian doner we will discuss in the next 
Session saturates these inequalities and is symmetric in a and b (and in x and 
p): 

An\ a = Anl a = Ar£ 6 = A< 6 = 1/2 (1.9) 

To simplify the notation, we will denote this cloning-induced excess noise 
variance as a 2 in the following. 

3. GAUSSIAN CLONING TRANSFORMATION 

We will define a class of cloning machines that yield two imperfect copies 
of a continuous-variable system, the underlying cloning transformation being 
covariant with respect to displacements in phase space (x,p). By this, we 
mean that any two input states that are related by a displacement result in 
copies that are related in the same way; hence, the resulting cloning fidelity 
is invariant under displacements in phase space. Specifically, let us seek for a 
displacement-covariant transformation which duplicates with a same fidelity all 
coherent states \ip). Thus, if two input states are identical up to a displacement 
D(x',p') = e~ tx Ve ip x , then their respective copies should be identical up to 
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Figure 1.1 Quantum circuit for the continuous-variable cloning transformation. It consists of 
four C-NOT gates preceeded by a preparation stage. Here, the ancillae are prepared in the state 
given by Eq. (1.19). See [5, 12]. 



the same displacement. Denoting by H the Hilbert space corresponding to a 
single system, cloning can be defined as a completely -positive trace-preserving 
linear map C : H -> H m : -► C(|^)(V>|) such that 

C [d(x', P ')\^}(4>\D^(x',p')] = D(x', P T 2 c(l^)^l) b\x', P ')® 2 

(1.10) 

for all displacements D(x',p'). 

As shown in [5] , this cloning map can be achieved via a unitary transformation 
U acting on three modes: the input mode (variable 1) supplemented with two 
auxiliary modes, the blank copy (variable 2) and an ancilla (variable 3). The 
two auxiliary variables must be initially prepared in the joint state 

p roc 

|X>2,3=// dxdpf(x,p)\V(x,-p)) 2 ,3 (l.H) 
where f(x,p) is an (arbitrary) complex amplitude function, and 

|¥(x,p)) = -= / dx' e tpx \x')\x' + x) (1.12) 

V27T J-oo 

are the EPR states (the maximally-entangled states of two continuous variables). 
The cloning transformation is defined as 

#1,2,3 = e - i{£3 - £2)fil e - i£l{ P 2+h) (1.13) 

where Xk (pk) is the position (momentum) operator for variable k. As shown 
in Fig. 1.1, this can be interpreted as a sequence of four continuous- variable 
controlled-NOT (c-not) gates, each being defined as the unitary transformation 
Q-ixkPi with k (I) referring to the control (target) variable [11]. 

Remarkably, Eq. (1.13) coincides with the discrete c-not gate sequence 
that achieves the qubit cloning transformation [13], up to a sign ambiguity 



6 



originating from the fact that a continuous c-not gate is not equal to its inverse. 
After applying U to the state |V')i|x)2,3, we get the joint state 

r z* 00 

// dxdpf(x,p) £>(x,p)|V>)i |*(x,-p)) 2 , 3 (1.14) 

J J—oo 

where variables 1 and 2 are taken as the two outputs of the doner (clones a 
and b), while variable 3 (the ancilla) must simply be traced over. This is a 
peculiar state in that it can be reexpressed in a similar form by exchanging the 
two clones, namely 

r roo 

// dxdpg(x,p) D(x,p)\il>) 2 |*(ar,-p))i,3 (1-15) 

J J —oo 

with 

1 r roo 

g{x, P ) = —JJ_Jx'dp' /(x ', p ') (i.i6) 

being the two-dimensional Fourier transform of f(x,p). The resulting state of 
the individual clones can then be written as 

p roo 

Pa= dxdp\f(x,p)\ 2 D(x,pMW\&(x,p) (1.17a) 

J J—oo 

p b = f f°° dxdp \g(x,p)\ 2 D(x,pMW\&(x,p) (1.17b) 

J J—oo 

which is consistent with tracing Eq. (1.10) over any one of the clones. Thus, 
the clones are affected by position and momentum errors that are distributed 
according to | / (x , p) \ 2 and | g (x , p) \ 2 . A central point here is that interchanging 
the two clones amounts to substitute the function / with its two-dimensional 
Fourier transform g. This property is crucial as it ensures that the two copies 
suffer from complementary position and momentum errors. Indeed, one can 
check [5] that the four excess noise variances defined as 

An 2 ,. = ff°° dxdp x 2 \f(x,p)\ 2 , (1.18a) 

J J — oo 

/roo 
/ dxdpp 2 \f(x,p)\ 2 (1.18b) 
J — oo 

An l,b= [ [ dxdp x 2 \g(x,p)\ 2 , (1.18c) 

J J—oo 
r roo 

Anl b = / / dxdpp 2 \g(x,p)\ 2 (1.1 8d) 

J J—oo 

obey the no-cloning inequalities (1.8a) and (1.8b). (Here, we assume that the 
first-order moments of \f(x,p)\ 2 and \g(x,p)\ 2 vanish, that is, the clones are 
not biased.) 
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Within this class of cloning machines parametrized by f(x,p), a particu- 
larly simple rotation-covariant doner can be found that provides two identical 
copies of a continuous system with the same error distribution in position and 
momentum. It corresponds to the choice f(x,p) = g(x,p) = e~( x +p ^ 2 /y/ir. 
This doner is named "Gaussian" as it effects Gaussian-distributed position- and 
momentum-errors on the input mode: the excess noise on both clones is dis- 
tributed as e - ^ +p ) /-7T, that is, as a bi-variate rotational-invariant Gaussian of 
variance a 2 = 1/2. This doner is optimal, as it satisfies Eq. (1.9). Here, the 
two auxiliary variables must be prepared in the state 

1 f f°° y 2 +z 2 

\x)2,3 = ^JJ dydze ~ \ y ) 2 \ y + z ) 3 (1.19) 

which is simply the product vacuum state 10)2(0)3 processed by a c-not gate 
e -tx 2 p:t ^he resulting transformation effected by U on an input position state 
\x) is thus given by 

1 f f°° y 2 +z 2 

\x)i\x)2,3 —;= \ \ dydze ~\x + y) 1 \x + z) 2 \x + y + z) 3 (l.20) 
V 71 " J J-00 

where the three variables denote the two clones and the ancilla, respectively. 
For an arbitrary input state it is readily checked that this transformation 
outputs two clones whose individual states are Gaussian distributed with a 
variance a 2 = 1/2, namely 

Pa = Pb=~ 1 1" dx dp e-( x2+p ^D(x,p)\TP){7p\D\x,p), (1.21) 

In particular, if the input is a coherent state | a) with a = (x + ip)/ y/2, it is easy 
to calculate the fidelity of this doner by using |(a|c/)| 2 = exp(— \a — a'\ 2 ): 

1 2 

F = (a\p a{b) \a) = 1 + An2 = 3 (1-22) 

This cloning fidelity does not depend on a, so this Gaussian doner copies all 
coherent states with the same fidelity 2/3. It can be viewed as the continuous 
counterpart of the universal qubit doner [13], as its cloning fidelity is invariant 
under rotations in phase space. The physical origin of the cloning noise be- 
comes, however, much more evident in the case of continuous variables: the 
Gaussian noise that affects the clones can simply be traced back to the Gaussian 
wave function of the two ancillary modes, see (1.19). This suggests that the 
noise that inevitably arises when cloning is intrinsically linked to the vacuum 
fluctuations of the auxiliary modes. 

Note finally that this formalism can easily be extended to the cloning of 
squeezed states instead of coherent states [5]. One simply unsqueeze the state 
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before cloning and then squeeze the clones again. For any value of the squeezing 
parameter r, one can then define a Gaussian doner that copies with fidelity 2/3 
all squeezed states of which the same quadrature is squeezed by the same amount 
r. In contrast, cloning these squeezed states using the rotation-covariant doner 
defined above results in a fidelity that decreases as r increases. 



It is very instructive to write the cloning transformation in the Heisenberg 
picture, that is, following the evolution of the annihilation operators associated 
with the modes that are involved. Again, mode 1 denotes the input mode, and 
modes 2 and 3 the ancillary modes. Mode 1' and 2' stand for the two clones, 
while 3 ' is the ancilla that is traced over after cloning. Here, aj = (xj +ipj ) / y/2 
stands for the annihilation operator for mode j. We require that the cloning 
transformation conserves the mean values, i.e., (a^) = (a' 2 ) = (cti), so that 
the clones are centered on the original coherent state. We also require that the 
cloning transformation is covariant under rotations in phase space. It is shown 
in [14] that the optimal transformation satisfying these requirements is 



where mode 1 is initially prepared in an arbitrary coherent state \a), with a = 
(x + ip)/\J~2, while modes 2 and 3 are prepared in the vacuum state. This 
transformation clearly satisfies the commutation rules [a-, a'j] = 5ij and yields 
the correct mean values (x,p) for the two clones (modes 1' and 2'). Also, 
one can easily check that the quadrature variances of the clones are equal to 
twice the vacuum noise, in accordance with the cloning excess noise variance 
a 2 = 1/2. This transformation actually coincides with the Gaussian doner 
introduced in the previous Section. Interestingly, we note here that the state 
in which the ancilla 3 is left after cloning is centered on (x, —p), that is the 
phase-conjugated state \a*). This means that, in analogy with the universal 
qubit doner, the Gaussian doner generates an "anticlone" (or time-reversed 
state) together with the two clones. 

As suggested by the above transformation, a possible optical implementation 
of this Gaussian doner consists in processing the input mode a\ into a linear 
phase-insensitive amplifier [15] of gain G = 2: 



4. 



OPTICAL IMPLEMENTATION 
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Figure 1.2 Implementation of a Gaussian doner using a phase-insensitive linear amplifier and 
a 50:50 beam-splitter (BS). See [12]. 



with mode 3 denoting the idler mode. This amplifier is limited by the quantum 
noise so it naturally leads to an optimal cloner. A gain G = 2 is needed since 
the cloner doubles the energy by creating two clones with the same energy as 
the input state. One then produces these two clones simply by processing the 
output signal of the amplifier through a 50:50 phase-free beam splitter, 

a[ = -^( a out + a 2 ), a 2 = -^(a out - a 2 ), (1.25) 

as shown in Fig. 1 .2. The rotation covariance of the resulting cloner is ensured by 
the fact that the amplifier and the beam splitter are phase-insensitive. Actually, 
combining Eqs. (1.24) and (1.25) results in the same canonical transformation 
as above, so this optical setup indeed implements the optimal Gaussian cloner. 
It is readily checked that this setup leads to an equal x- and p-error variance of 
1/2 for both clones. 

5. GAUSSIAN CLONERS WITH MULTIPLE INPUTS 
AND OUTPUTS 

Let us now consider the general problem of optimal N — > M cloning, 
extending what was done in [16] for the case of quantum bits. Consider a 
Gaussian transformation which, from N (> 1) identical replicas of an original 
input state, produces M (> 2) output copies whose individual states are again 
given by an expression similar to Eq. (1.21) but with an error variance <j 2 n,m- 
(For the 1 — > 2 Gaussian cloner above, we had a 2 i^ = 1/2.) Using an 
argument based on the concatenation of doners, it is possible to derive a lower 
bound on cr 2 ^ ^, that is [8] 
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so that the corresponding cloning fidelity for coherent states satisfies 

Fnm < • (1-27) 

• ~ MN + M -N V ' 

The proof is connected to quantum state estimation theory, the key idea being 
that cloning should not be a way of circumventing the noise limitation encoun- 
tered in any measuring process. More specifically, concatenating a N — ► M 
doner with a M — > L doner results in a TV — ► L doner that cannot be better that 
the optimal N — > L doner. We then make use of the fact that the excess noise 
variance of this N — > L doner simply is the sum of the excess noise variances 
of the two component doners [8]. Denoting by a% M the excess noise variance 
of the optimal N — > M doner, we get the inequality a% L < a% M + cr\j L . 
In particular, if L — > oo, we have 

a N,oo - a M,oo < a N,M (1.28) 

Since the limit of cloning with an infinite number of clones corresponds to a 
measurement, Eq. (1 .28) simply implies that cloning the N replicas before mea- 
suring the M resulting clones does not provide a mean to enhance the accuracy 
of a direct measurement of the N replicas. This limit is useful because the joint 
measurement of x and p on N identical replicas of a coherent state is known to 
give a minimum noise variance cr 2 N ryo = 1/N. This, combined with Eq. (1.28), 
gives the minimum noise variance induced by cloning, Eq. (1.26), along with 
the corresponding cloning fidelity, Eq. (1.27). Note that these bounds can also 
be derived when N = 1 using techniques similar to the ones used for describing 
quantum nondemolition measurements. This was done in a paper establishing 
a link between cloning and teleportation for continuous variables [10]: for the 
1 — > 2 doner, the teleportation fidelity must exceed = 2/3 in order to 
guarantee that the teleported state is of better quality than the state kept by the 
emitter. 

Just like for the 1 — > 2 doner, the bounds Eqs. (1.26) and (1.27) can be 
attained by a transformation whose implementation requires only a phase- 
insensitive linear amplifier and beam splitters [14, 17]. Loosely speaking, the 
procedure consists in concentrating the N input modes into a single mode by 
use of a network of beam splitters, then in amplifying the resulting mode and 
distributing the output mode of the amplifier into M modes through a second 
network of beam-splitters. A convenient way to achieve these concentration 
and distribution stages is provided by networks of beam splitters that realize a 
Discrete Fourier Transform (DFT). Cloning is then achieved by the following 
three-step procedure (see Fig. 1.3). First step: the N input modes are concen- 
trated into a single mode through a DFT (acting on N modes): 

j JV-l 

a 'k = ^ff E exp(ifc/2vr/iV) a u (1.29) 
v^ v i=o 
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Figure 1.3 Implementation of an TV — + M continuous- variable cloning machine based on a 
phase-insensitive linear amplifier. Here, C stands for the amplitude concentration stage while 
D refers to amplitude distribution. Both can be realized using a network of beam-splitters that 
achieve a DFT. See [14]. 



with k = . . . TV — 1. This operation concentrates the energy of the ./V in- 
put modes ai into one single mode a' (hereafter renamed ao) and leaves the 
remaining N — 1 modes (a[ . . . a' N _{) i n th e vacuum state. Second step: the 
mode ao is amplified with a linear amplifier of gain G = M/N. This results in 



a o = WT7 a o + \/^7-laL (1.30a) 




< = v^- la W^ a - (L30b) 

Third step: amplitude distribution by performing a DFT (acting on M modes) 
between the mode a' and M — 1 blank modes in the vacuum state: 

j M-l 

4 = —J2 exp(ikl2ir/M) a' h (1.31) 

with k = ... M - 1, and a[ = a» for i = N . . . M - 1. The DFT now 
distributes the energy contained in the output of the amplifier among the M 
output clones. 

It is readily checked that this procedure meets the requirements we put on the 
N — ► M doner, and is optimal. Indeed the quadrature variance of the M output 
modes gives 1/2 + 1/ N — 1/M, implying that the cloning-induced excess noise 
variance is 1/N — 1/M. Furthermore, the transformation is rotation co variant 
since the amplifier and the beam splitters are phase insensitive. In conclusion, 
we see that the optimal N —> M cloning transformation can be implemented 
using only passive elements except for a single linear amplifier. 

The above cloning transformation can be extended even further by consider- 
ing a generalized doner that produces M clones from N replicas of a coherent 
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state and N' replicas of its complex conjugate [18]. It is again universal over 
the set of coherent states in the sense that the cloning fidelities are invariant 
for all input coherent states. Interestingly, it can be shown that supplement- 
ing the N input states \ip)® N with N' phase-conjugated input states \ip*)® N 
can, under certain circumstances, provide clones with a higher fidelity than the 
above N + N' — > M doner. Note that, together with the M clones, this phase- 
conjugate input doner also yields M' anticlones (approximate copies of 
at no cost, with N — N' = M — M'. The advantage of having phase-conjugated 
inputs for a continuous-variable doner actually also has a counterpart in the con- 
text of qubit doners. Indeed, motivated by this finding on continuous-variable 
doners, an optimal universal cloning transformation was recently derived that 
produces M copies of an unknown pair of orthogonal qubits [19]. For M > 6, 
the cloning fidelity for a pair of orthogonal qubits can be shown to be higher 
than that of the optimal cloning of a pair of identical qubits. This is a first 
example of a quantum informational process that was initially described for 
continuous-variable systems and only later on extended back to quantum bits. 

6. EAVESDROPPING IN CONTINUOUS- VARIABLE 
QUANTUM CRYPTOGRAPHY 

As mentioned above, quantum cloning can be viewed as an individual eaves- 
dropping strategy in continuous-variable quantum cryptography. Consider a 
quantum key distribution scheme in which the key is encoded into the displace- 
ment of a coherent or a squeezed state that is drawn from a Gaussian distribution 
[3, 4]. In the continuous- variable protocol defined in [3], which we will analyze 
here, squeezed states need to be used. The emitter (Alice) prepares a squeezed 
state for which the quadrature that is squeezed, x or p, is chosen at random, 
and then displaces it by D(r, 0) or D(0, r) depending on x or p is squeezed. 
Here, r is drawn from a Gaussian distribution, and constitutes a continuous key 
element. The receiver (Bob) then measures either the x- or p-quadrature of the 
state he received, this choice being again random. After Bob's measurement, 
Alice reveals the quadrature she squeezed (and displaced) and Bob rejects the 
cases where he measured the wrong quadrature, this discussion being made 
over an authenticated public channel (this procedure is known as sifting). The 
subset of states that are accepted by Bob then constitutes a Gaussian raw key 
(correlated Gaussian data at Alice's and Bob's side). Indeed, denoting as v 
the variance of the quadrature that is squeezed by Alice, Bob gets for his mea- 
sured quadrature an outcome r' that is Gaussian distributed around r with a 
variance v (assuming for the moment that the quantum channel is perfect and 
that there is no eavesdropping). If the variance of the random displacements r 
imposed by Alice is noted V, then this raw key shared by Alice and Bob can be 
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viewed as resulting from a Gaussian additive-noise channel characterized by a 
signal-to-noise ratio ofV/v. 

The maximum amount of shared key bits that can be extracted from this 
Gaussian raw key can be analyzed by applying some standard notions of Shan- 
non theory for continuous channels [see e.g. [20]]. Consider a discrete-time 
continuous channel that adds a Gaussian noise of variance v to the signal. If 
the input r of the channel is a Gaussian signal of variance V, the uncertainty on 
r can be measured by its Shannon entropy h(r) = 2" 1 log 2 (27r e V) bits. Con- 
ditionally on r, the output r' is distributed as a Gaussian of variance v, so that 
the entropy of r' conditionally on r becomes h(r'\r) = 2~ 1 log 2 (27rev) bits. 
Now, the overall distribution of r' is of course the convolution of these two 
distributions, i. e., a Gaussian of variance V + v , so that the output entropy is 
h(r') = 2~ 1 log 2 (2-7re (V + v)) bits. According to Shannon theory, the infor- 
mation processed through this noisy channel r —> r' can be expressed as the 
amount by which the uncertainty on r' is reduced by knowing r, that is 



where V/v is the signal-to-noise ratio. This is Shannon's famous formula for 
the capacity of a Gaussian additive-noise channel. It is worth noticing that this 
capacity is achieved in the case where the input is distributed as a Gaussian, 
which is precisely the case under consideration here. 

In the protocol analyzed in [3], the variances v and V are related by the 
constraint that Alice's choice of encoding the key into either x or p should be 
invisible to a potential eavesdropper. In the first case, Alice applies a Gaussian- 
distributed displacement D(r, 0) on a squeezed state whose x quadrature has 
a variance v, so that the quadratures x and p of this Gaussian mixture have a 
variance V + v and l/(4v), respectively. In the second case, Alice applies a 
displacement D(0, r) on a squeezed state in p, resulting in a Gaussian mixture 
with variances 1 / (Av) and V + v for x and p. These two Gaussian mixtures are 
required to be indistinguishable, which simply translates into the requirement 
that they have the same x variances and the same p variances: 




V 



) 



(1.32) 



v 



1 

+ v = — 

Av 



(1.33) 



This gives for the information 




(1.34) 



which measures the maximum number of key bits that can be extracted asymp- 
totically (at the limit of long sequences) per use of the channel. (The factor 
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1/2 here is just the vacuum noise, so we see that this protocol requires squeez- 
ing, that is, v < 1/2.) The actual methods that may be used to discretize the 
Gaussian raw key and correct the resulting errors so as to extract a common bit 
string are known as reconciliation protocols [21]. 

Let us now consider the information that is transmitted in the presence of 
an eavesdropper. We assume that the eavesdropper (Eve) processes each key 
element into a Gaussian cloning machine, keeps one clone, and sends the other 
one to Bob. Once the quadrature that contains the key (x or p) is revealed by 
Alice and Bob, Eve properly measures her clone. Clearly, Eve needs to use 
an asymmetric version of the Gaussian doner described above as she must be 
able to tune the information she gains, and therefore the disturbance she effects 
in the transmission. (A possible implementation of this asymmetric Gaussian 
doner is discussed in [17].) Thus, Eve adds some extra noise on the quadrature 
encoding the key, which results in a reduced signal-to-noise ratio on Alice-Bob 
channel. Remember here, that the quality of the two clones obey a no-cloning 
uncertainty relation akin to the Heisenberg relation, implying that the product 
of the x-error variance on the first clone times the p-error variance on the second 
one remains bounded by (1/2) 2 ; see Eqs. (1.8a) and (1.8b). In particular, if x 
and p are treated symmetrically, we have 

An| An| > (1/2) 2 (1.35) 

This translates into a balance between the signal-to-noise ratio in Alice-Bob 
channel V/(v + An|) and that in Alice-Eve channel V/(v + An 2 E ). This 
latter channel is also a Gaussian channel so it can be treated similarly. Using 
Eq. (1.33), we can write the information processed respectively in Alice-Bob 
and Alice-Eve channels as 



1 i l + 4v An| 

2 ° g2 \Av(v + An 2 B ) 



Iab = .log 2 I 7777. , a. 2 J ( L36a ) 



1 ( l + 4v Anl \ 



which gives 



1 /(l +Av An 2 R )(l + Av Anl)\ 

Iab + Iae-I=, log 2 r? Il~a 2 / I A 2 f ( L37 ) 

2 y A(v + An B ){v + An z E ) J 

One can then show that Iab + Iae — I < by checking that the quantity inside 
the logarithm is less or equal to one. This simplifies to the condition 

1 _ V 2 < 4 An| An| (1 - Av 2 ) (1.38) 

which is indeed true as a consequence of Eq. ( 1.35) and v < 1/2. Consequently, 
we have proven that, in this quantum cryptographic protocol, the no-cloning 
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uncertainty relation translates into an information exclusion principle [3] 

Iab + Iae<I (1-39) 

In other words, the information Iae gained by Eve is upper bounded by the 
defect of information at Bob's side, / — Iab, which implies that the secu- 
rity is guaranteed if Iab > 1/2 (since Bob then has an advantage over Eve, 
Iab > Iae)- Note that the bound in Eq. (1.39) is saturated by the asymmet- 
ric Gaussian doner discussed above, which strongly suggests that this is the 
optimal individual attack (this actually can be proven rigorously). In practice, 
Alice and Bob can estimate the potentially eavesdropped information in the 
following way. Alice discloses the values r she sent for a random subset of the 
raw key. Then, Bob compares them to the values r' he received, in order to 
estimate the variance of the distribution of the differences r' — r, i. e., the excess 
noise variance An|. This is sufficient to estimate Iab, and, via Eq. (1.39), an 
upper bound on Iae- 

An extended continuous-variable quantum key distribution protocol relying 
on Gaussian key carriers has recently been proposed in [4] , where coherent states 
may be used instead of squeezed states. The encoding then consists in imposing 
a displacement D(x,p) onto the vacuum state with x and p being drawn from a 
bi-variate Gaussian distribution. Here, the choice of the quadrature is made by 
Bob, who decides to measure x or p at random, and then discloses his choice 
on the public channel. The corresponding value of Alice's displacement (x 
or p) together with Bob's measured outcome again can be viewed as resulting 
from a Gaussian channel, so the above information-theoretic treatment can 
be extended. In particular, one can calculate Iab and Iae in the case of an 
individual attack based on asymmetric Gaussian doners. The security analysis 
of this coherent-state protocol is beyond the scope of the present paper. 
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